Scammers Abuse Shopify to Send Fake Invoices and Steal Credentials via Fake Support Calls

Gbhackers •Divya • June 26, 2026

Scammers are increasingly exploiting Shopify’s ecosystem and its Shop order-tracking app to deliver fraudulent invoices directly into users’ purchase histories, marking a shift from traditional email-based phishing to in-app social engineering attacks. Security researchers Luis Corrons and Jakub Vavra from Gen have identified multiple campaigns in which fake receipts appear in the Shop app, impersonating […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Shopify's Shop App Targeted by Callback Phishing Scams Threat actors are exploiting Shopify's Shop app to insert fake purchase receipts into users' order histories, tricking them into revealing sensitive information or installing malicious software. The app, popular in North America with 50 million downloads, has seen scammers impersonating reputable brands like Norton and PayPal. Victims are misled into calling a fraudulent support number listed on these receipts, where scammers attempt to extract account credentials and payment details. Researchers from Gen Digital have identified this shift from traditional email phishing to in-app attacks as particularly effective due to the inherent trust users place in the app. Although the exact method of how these fake receipts are inserted remains unclear, no evidence suggests that Shopify or the impersonated companies have been compromised. Users are advised to verify any suspicious receipts directly with their banks and to reset passwords if they have already engaged with the scammers. 7 sources 62

Extracted Entities

Scammers Abuse Shopify to Send Fake Invoices and Steal Credentials via Fake Support Calls

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Platforms (1)